Management understands the benefits and limitations of the technology in use and whether other controls must compensate for its limitations, and continually assesses whether its processes, people and technology can sustain the appropriate level of security for its risk profile, size, complexity and risk appetite, since security fails when design and policy do not defend against threats, threats change beyond the design or controls stop operating as intended.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.